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Introduction 

We are acyber security firm specialized in web application security. 

With the increased demand for self-service, companies have invested heavily in making consumer 
information available online through web applications. Developing more features for customer 
delight, wins typically from improving security. Making sure that companies build safer applications 
must therefore come from a non-commercial body. Keep up the good work EPDB! 


General finding guidelines 01/2021 

All measures, means of mitigation and preventions mentioned in the guidelines are based on the old 
methods of cyber security. The new digital world requires modern methods of protection. For web 
applications specifically we have an addition to make things saver. 


Rapid changes 

Online environments change so rapidly that periodic measures (i.a. penetration testing) need to be 
layered with continuous testing of the durability of your environment. Continuous testing of the 
impact of the changes that took place. This can be done by continuous analysis of the logging. 


Log analysis 

Point 49 mentions logging as a measure of determination after the fact. 

European citizens want data breaches to be investigated, but even more they want them to be 
prevented! Continuous log analysis is an excellent measure to prevent breaches taking place. It 
provides insights in accurate actual threats besides the use for prove after the breach. 


Suggested sentence 
Forwarding or replication of all logs to a central log server to log and to analyse for actual current 
threats. 


Benefit for EDPB and Citizens 

Analysing actual threats surfaces breaches quicker and prevents more data being exfiltrated. 
Besides, it gives the EU citizens quicker information of where their information might have been 
compromised. It takes an average of 9 months before companies realise a data breach has taken 
place. 


Thankful to be able to add to a saver digital Europe! 
Let me know if there are any further questions 


Ir. Joost Sprakel 
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